{"id":218,"date":"2024-05-27T10:20:00","date_gmt":"2024-05-27T08:20:00","guid":{"rendered":"https:\/\/blog.comping.fi\/?p=218"},"modified":"2024-09-23T16:26:01","modified_gmt":"2024-09-23T14:26:01","slug":"netscaler-basic-on-prem-authentication","status":"publish","type":"post","link":"https:\/\/blog.comping.fi\/?p=218","title":{"rendered":"NetScaler Basic on-prem authentication"},"content":{"rendered":"\n

As promised; here’s the first one of the three real-life authentication examples. I will post the next one tomorrow and the final one the day after tomorrow.<\/p>\n\n\n\n

Overview<\/h2>\n\n\n\n

In this use case the NetScaler acts as a load balancer (aka reverse web proxy) for the web front end servers, but also enables the authenticate, authorize and audit (AAA-TM) feature (NetScaler Docs<\/a>). For the on-premises the LDAP authentication capability is used either with SSO and authorization or without.<\/p>\n\n\n\n

AAA processing<\/h3>\n\n\n\n

This example is applicable for sessions established from the internal networks or VPN clients.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
    \n
  1. User initiates a connection to https:\/\/service.my.domain\/production\/prod-system.html (if needed, the NetScaler can redirect user from the root path to the proper URL path)<\/li>\n\n\n\n
  2. As the session was unauthenticated, the NetScaler AAA-TM redirects the user to the NetScaler authentication form page \/logon\/LogonPoint\/tmindex.html (in this example a shared host name is used for the authentication services)<\/li>\n\n\n\n
  3. The browser requests \/logon\/LogonPoint\/tmindex.html<\/li>\n\n\n\n
  4. Authentication form or 401 challenge is presented<\/li>\n\n\n\n
  5. User enters credentials (or automatically SSO using Negotiate\/Kerberos for example)<\/li>\n\n\n\n
  6. After a successful authentication and LDAP bind the group membership for the user is queried<\/li>\n\n\n\n
  7. A list of groups is collected from LDAP<\/li>\n\n\n\n
  8. Successful authentication adds the authentication cookie (NSC_AAAC) for the user session and redirects the session back to the original URL<\/li>\n\n\n\n
  9. The original URL is requested with the authentication cookie<\/li>\n\n\n\n
  10. The load balancing vServer proxies the traffic to the web front (optionally checks for AD group-based authorization), SSO is possible with the given credentials or configuring the NetScaler AAA as an IdP (for SAML or OIC\/OAuth2)<\/li>\n\n\n\n
  11. A session is established from the NetScaler to the backend<\/li>\n\n\n\n
  12. An authenticated (and optionally authorized) session is established<\/li>\n<\/ol>\n\n\n\n

    Summary<\/h3>\n\n\n\n

    This answers to the questions discussed in earlier posts Security basics, part 2 \u2013 Who?<\/a> and Security basics, part 3 \u2013 Where?<\/a>. It all comes down to a common thread, but a bit more technical angle this time.<\/p>\n\n\n\n

    Followup<\/h2>\n\n\n\n

    Next one is out tomorrow<\/h3>\n\n\n\n

    In the next post we’ll discuss publishing a resource to the internet and authenticating it using Microsoft Entra ID (or similar).<\/p>\n\n\n\n

    A real head scratcher?<\/h3>\n\n\n\n
    \n
    \n
    \"\"<\/figure>\n<\/div>\n\n\n\n
    \n

    Would you find this useful in your environment?<\/p>\n\n\n\n

    Don’t hesitate to contact me, the address is kari.ruissalo@comping.fi<\/a>.<\/p>\n\n\n\n

    I have NetScaler key-chain after all so I must know something about this!<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    As promised; here’s the first one of the three real-life authentication examples. I will post the next one tomorrow and the final one the day after tomorrow. Overview In this use case the NetScaler acts as a load balancer (aka reverse web proxy) for the web front end servers, but also enables the authenticate, authorize … NetScaler Basic on-prem authentication<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5,6,4],"tags":[17,18,7],"class_list":["post-218","post","type-post","status-publish","format-standard","hentry","category-identity","category-netscaler","category-security","tag-basic-authentication","tag-ldap","tag-netscaler"],"_links":{"self":[{"href":"https:\/\/blog.comping.fi\/index.php?rest_route=\/wp\/v2\/posts\/218","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.comping.fi\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.comping.fi\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.comping.fi\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.comping.fi\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=218"}],"version-history":[{"count":7,"href":"https:\/\/blog.comping.fi\/index.php?rest_route=\/wp\/v2\/posts\/218\/revisions"}],"predecessor-version":[{"id":229,"href":"https:\/\/blog.comping.fi\/index.php?rest_route=\/wp\/v2\/posts\/218\/revisions\/229"}],"wp:attachment":[{"href":"https:\/\/blog.comping.fi\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.comping.fi\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.comping.fi\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}